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AMENDMENTS TO THE CLAIMS 

This listing of claims replaces all prior versions and listings of claims in the 
application: 

Listing of claims: 
1. - 11. (Cancelled) 

12. (Currently Amended) A method for classifying connections detected between 
senders and receivers [[in]] belonging to a communication network[[s]] , said senders and 
receivers using communication protocols, each communication protocol designated by a 
user protocol name, said method being performed and operated by means of a computing 
system and including, operated by said computing system , the method comprising : 

recognizing determinant information on the protocol designated by said name, 

from among information conveyed in a detected connection, by a protocol 
self-identifier mechanism associated with each implicit and explicit used 
protocol name and devised to recognize said determinant information; 
establishing a non-empty or empty list of potentially used protocol names referred 



protocol names being associated with one of each said used protocol 
names, the protocol name so associated with the list of son protocol names 
being referred to as father protocol name ; and 
for each detected connection, by a computing kernel operated by said computing 
system; constructing and thus associating to each detected connection a 
first data structure devised so as to contain an ordered sequence of used 
protocol names which is initialized with a so-called base protocol name, 
said first data structure being devised by ? 



to as ajist of son protocol names, with said 




-list of son 



constructing said first data structure by searching, throughout 
said list of son protocol names associated with the last name of said 
ordered sequence, 
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by discriminating between implicit and explicit son protocol 
name, for a son protocol name for which said associated self-identifier 
mechanism recognizes determinant information from among said 
conveyed information and then 

by appending to the end of said ordered sequence said son 
protocol name when it is found and by starting repeating the search 
again otherwise, so long as it is possible to find in said list of son 
protocol names which is associated with the last name of said ordered 
sequence, a son protocol name for which said associated self-identifier 
mechanism recognizes determinant information from among said 
conveyed information; and declaring said detected connection as being 
classified when it is no longer possible to find, in said list of son 
protocol names associated with the last name of said ordered sequence, 
a son protocol name for which said associated self-identifier 
mechanism recognizes determinant information from among said 
conveyed information. 



13. (Previously Presented) The method of claim 12, wherein said searching for an 
implicit son protocol name includes submitting by means of said computing kernel said 
conveyed information to each self-identifier mechanism associated with a name from said 
list of son protocol names until one of said self-identifier mechanism declares recognition 
of determinant information or until no self-identifier mechanism can declare recognition 
of determinant information. 

14. (Previously Presented) The method of claim 12, wherein said searching for an 
explicit son protocol name includes submitting by means of said computing kernel said 
conveyed information to the self-identifier mechanism associated with the last name of 
said ordered sequence, so as to allow said self-identifier mechanism to find said son 
protocol name among the determinant information of said father protocol. 
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15. (Currently Amended) The method of claim 12, including establishing a current 
signature for each detected connection by said computing kernel, by: 

submitting all or part [[or]] ofsaid conveyed information to at least one self- 
identifier mechanism associated with one of the names of low rank in said 
ordered sequence; 

finding among the determinant information source and destination indicators by 

using said self-identifier mechanism; and 
incorporating said source and destination indicators into said current signature. 

16. (Currently Amended) The method [[or]] of claim 15, including cataloguing each 
first data structure in a first table by said computing kernel by establishing a first 
associative correspondence between each first data structure and the current signature 
established for the associated connection. 

17. (Previously Presented) The method of claim 16, further including establishing by 
said computing kernel in said first table a second associative correspondence between 
each current signature and a peer signature whose source indicators arc the indicators of 
destination of the current signature and whose destination indicators are the source 
indicators of the current signature. 

18. (Currently Amended) The method of claim 16, further including, operated by said 
computing kernel the steps of : 

gatherin g, from [[in]] data packets passing through said computing system within 
connections to be detected,, the useful determinant information conveyed 
so as to formulate a signature and thus the current signature whenever the 
useful information conveyed is sufficient; 

using said current signature thus formulated in real time to detect a connection, by 
searching in said first table for the first data structure which corresponds to 
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said current signature, associating a new first data structure with said 
detected connection when there exists no first data structure which 
corresponds to said current signature, [[by]] starting or continuing to 
construct said first data structure when there exists a first data structure 
which corresponds to said current signature, and [[by]] gathering from 
[[in]] the data packets the useful information conveyed so as to construct 
said first data structure. 



19. (Currently Amended) The method of claim 18, further including when the useful 
determinant information gathered from [[in]] a data packet is not sufficient to formulate a 
signature, operated by said computing kernel the steps of : 

cataloguing the useful determinant information in a second table by establishing 
an associative correspondence between the useful information which thus 
comprises links or memberships to one and the same connection, until said 
useful determinant information is sufficient to formulate said current 
signature. 
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20. (Currently Amended) The method of claim 12, further including operated by said 
computing kernel the steps of : 

reading the used protocol names of said ordered sequence in the data structure the 
computing kernel is building up, so as to detect each dynamic connection 
protocol name; and a 

for each dynamic connection protocol name detected[[;]] 2 submitting the 

information conveyed to the self-identifier mechanism associated with the 
name detected so as to determine whether there exists a subsequent 
dynamic connection; and^ 

if a subsequent connection existsff;]^ associating therewith a second data 
structure devised so as to contain an ordered sequence of potential 
protocol names which begins with said so-called base protocol name. 

21. (Currently Amended) The method of claim 20 further including, operated by said 
computing kernel , the steps of cataloguing each second data structure in a second table by 
establishing an associative correspondence between each second data structure and a 
potential signature formulated by said self-identifier mechanism associated with the name 
detected. 

22. (Currently Amended) The method of claim 21, further including operated by said 
computing kernel the steps of : 

searching for the ordered sequences of potential protocol names in which the 
ordered sequence of used protocol names is included; and, when there 
exists an ordered sequence of potential protocol names whose potential 
signature corresponds to said current signature; 

completing said first data structure by means of said second data structure. 



